The [email protected] npm package executes a hardcoded HTTPS GET request on startup to a third-party domain (ft8swuagwwf6newi.ixx.sh), embedding sensitive host information such as the installer's process UID and hostname in the URL and User-Agent header. This behavior acts as a beacon to an out-of-band DNS/HTTP listener controlled by the package author, enabling host identification data to be logged externally. Although labeled as a proof-of-concept demonstrating arbitrary code execution risks in stdio MCP servers, the package's publication on npm exposes downstream users to unintended data leakage.

Systems running [email protected] will have their process UID and hostname transmitted to a third-party server controlled by the package author. This results in host identifier exfiltration, potentially compromising privacy and enabling further targeted attacks or reconnaissance by the malicious actor. There is no indication of additional payloads or exploitation beyond this data leakage.

No official patch or remediation is currently documented for this package. Users should avoid installing or running [email protected]. Since this is a malicious package published on npm, the best mitigation is to remove it from any environment where it is installed and to audit dependencies to prevent inclusion of this package. Monitor npm advisories for any updates or removals related to this package.